Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-84768 | critical | 9.3 | No | Unauthenticated SQL Injection in VikAppointments Services Booking Calendar <= 1.2.20 versions. | 2026-09-03 |
| CVE-2026-84765 | high | 7.1 | No | Unauthenticated Cross Site Scripting (XSS) in Breadcrumb NavXT <= 7.5.1 versions. | 2026-09-03 |
| CVE-2026-84762 | medium | 5.3 | No | Unauthenticated Bypass Vulnerability in WP EasyPay <= 4.5.3 versions. | 2026-09-03 |
| CVE-2026-84757 | high | 8.2 | No | Unauthenticated Settings Change in WP Compress <= 7.21.28 versions. | 2026-09-03 |
| CVE-2026-84755 | medium | 6.5 | No | Unauthenticated Broken Access Control in Mail Mint <= 1.31.0 versions. | 2026-09-03 |
| CVE-2026-84752 | high | 8.8 | No | Contributor PHP Object Injection in RTMKit <= 2.1.5 versions. | 2026-09-03 |
| CVE-2026-84736 | not reported | — | No | In the current development version of Eclipse aeriOS, for which no official release has yet been published, the Federator component disables... | 2026-09-03 |
| CVE-2026-84215 | medium | 6.5 | No | Unauthenticated Broken Access Control in Timetics <= 1.0.61 versions. | 2026-09-03 |
| CVE-2026-84143 | critical | 9.8 | No | Internally found bugs present in Thunderbird 154, Thunderbird ESR 153.1 and Thunderbird ESR 140.14. Some of these bugs showed evidence of me... | 2026-09-03 |
| CVE-2026-84142 | critical | 9.8 | No | Internally found bugs present in Thunderbird 154. Some of these bugs showed evidence of memory corruption or another security-relevant defec... | 2026-09-03 |
| CVE-2026-84141 | critical | 9.8 | No | Integer overflow in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and T... | 2026-09-03 |
| CVE-2026-84140 | critical | 9.8 | No | Site isolation issue in the DOM: Navigation component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and... | 2026-09-03 |
| CVE-2026-84139 | medium | 6.1 | No | Clickjacking issue in the DOM: Events component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunde... | 2026-09-03 |
| CVE-2026-84138 | medium | 6.5 | No | Denial-of-service in the PDF Viewer component. This vulnerability was fixed in Firefox 155 and Thunderbird 155. | 2026-09-03 |
| CVE-2026-84137 | medium | 4.3 | No | Spoofing issue in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thund... | 2026-09-03 |
| CVE-2026-84136 | medium | 6.1 | No | Other issue in the DOM: Navigation component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbi... | 2026-09-03 |
| CVE-2026-84135 | critical | 9.8 | No | Other issue in Firefox Focus for Android. This vulnerability was fixed in Firefox 155. | 2026-09-03 |
| CVE-2026-81300 | high | 7.1 | No | Unauthenticated Cross Site Scripting (XSS) in Calculation For Contact Form 7 <= 1.0 versions. | 2026-09-03 |
| CVE-2026-81292 | high | 7.1 | No | Unauthenticated Cross Site Scripting (XSS) in Simple Payment <= 2.5.1 versions. | 2026-09-03 |
| CVE-2026-51767 | critical | 9.8 | No | Incorrect access control in the recvClearPairCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to reset pai... | 2026-09-03 |